> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sapiom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Sapiom Pay is for platforms whose agent shops for many end users. Each end user is a buyer with their own Sapiom key and saved cards.
> Use the buyer's key for every call made on that buyer's behalf. Never use one buyer's key for another user, and never give the agent the platform key.
> Backends call the REST API at https://api.sapiom.ai/v1. Agents can also call the hosted MCP tools at https://api.sapiom.ai/v1/mcp. Both take the key in an x-api-key header.
> Never ask a buyer for a card number, expiry date or CVV in chat. Buyers enter card details only on Sapiom's hosted pages.
> Check the merchant before buying. Use purchase.type ucp_checkout only when the merchant check returns supported. Otherwise use browser_checkout.
> Follow the nextAction in each transaction result. Action links are secrets for the intended buyer only.
> Use one idempotency key per transaction. After a timeout, retry with the same key. Never start a new transaction to escape an uncertain outcome.
> For a ucp_checkout purchase, report an order as placed only when order.outcome is confirmed; if it is unknown, stop and hand off to a person. A browser_checkout purchase has no order confirmation (order is null): confirm the order on the merchant's page.

# Relay a card request

> Sends a card request that Browser Pay paused in the buyer's browser on to the payment provider. The request carries the transaction's placeholder card; the card provider replaces it with the real card, at most once per placeholder. The response is the payment provider's answer, or a typed refusal. Requires a [buyer key](/api-reference/overview#authentication).



## OpenAPI

````yaml /api-reference/openapi.json post /v1/transactions/{transactionId}/payment/relay
openapi: 3.0.0
info:
  title: Sapiom Pay API
  version: '1.0'
  description: >-
    Create buyers, save their cards and authorize transactions. Send your
    platform key or a buyer key in the `x-api-key` header.
servers:
  - url: https://api.sapiom.ai
    description: Production
security:
  - api-key: []
tags:
  - name: Buyers
    description: One buyer per end user. Called tenants in the API.
  - name: Cards
    description: Hosted card setup links and the buyer's saved cards.
  - name: Spending limits
    description: Limits on what each card can spend.
  - name: Merchants
    description: Check whether Sapiom can buy from a merchant.
  - name: Transactions
    description: Create, read and cancel a transaction, and drive its UCP checkout.
  - name: Browser Pay relay
    description: The relay Browser Pay uses to send the card, for either purchase type.
paths:
  /v1/transactions/{transactionId}/payment/relay:
    post:
      tags:
        - Browser Pay relay
      summary: Relay a card request
      description: >-
        Sends a card request that Browser Pay paused in the buyer's browser on
        to the payment provider. The request carries the transaction's
        placeholder card; the card provider replaces it with the real card, at
        most once per placeholder. The response is the payment provider's
        answer, or a typed refusal. Requires a [buyer
        key](/api-reference/overview#authentication).
      operationId: CardRelayController_relay
      parameters:
        - name: transactionId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RelayRequestDto'
      responses:
        '200':
          description: >-
            `relayed`, `refused` with a `reason` and `retryable` (and a
            `requestId` on `sapiom_error`), or `unknown`
      security:
        - api-key: []
components:
  schemas:
    RelayRequestDto:
      type: object
      properties:
        injectionRef:
          type: string
          format: uuid
          description: The placeholder's `injectionRef`.
        profileId:
          type: string
          maxLength: 64
          example: shopify-card-vault
          description: >-
            The injection profile the request matched. Without one, the relay
            sends it to its own URL.
        pageOrigin:
          type: string
          maxLength: 200
          example: https://store.myshopify.com
          description: The top-level page's origin.
        request:
          $ref: '#/components/schemas/PausedRequestDto'
        idempotencyKey:
          type: string
          maxLength: 255
          description: Repeating a relay with the same key returns its first result.
      required:
        - injectionRef
        - pageOrigin
        - request
        - idempotencyKey
    PausedRequestDto:
      type: object
      properties:
        method:
          type: string
          maxLength: 16
          example: POST
        url:
          type: string
          maxLength: 2048
          example: https://checkout.pci.shopifyinc.com/sessions
        headers:
          type: object
          description: >-
            Names in lower case. Through a profile only its forwarded headers
            count; without one, every header but the connection's is forwarded.
        body:
          type: string
          maxLength: 65536
          description: >-
            The paused body as the form wrote it, placeholder included: JSON or
            form fields.
      required:
        - method
        - url
        - headers
        - body
  securitySchemes:
    api-key:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your platform key for buyer management, or a buyer key for everything
        else.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.